1.导入jar包
<dependency>
<groupId>org.apache.shiro</groupId>
<artifactId>shiro-spring</artifactId>
<version>1.4.0</version>
</dependency>
2.编写配置类
package org.huqi.config;
import java.util.LinkedHashMap;
import java.util.Map;
import org.apache.shiro.mgt.SecurityManager;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.spring.security.interceptor.AuthorizationAttributeSourceAdvisor;
import org.apache.shiro.spring.web.ShiroFilterFactoryBean;
import org.apache.shiro.web.mgt.DefaultWebSecurityManager;
import org.springframework.aop.framework.adapter.DefaultAdvisorAdapterRegistry;
import org.springframework.aop.framework.autoproxy.DefaultAdvisorAutoProxyCreator;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
//标记当前类是spring的配置文件
@Configuration
public class ShiroConfig {
/**
* 配置一个SecurityManager 安全管理器
* */
@Bean
public SecurityManager securityManager(Realm myRealm) {
DefaultWebSecurityManager defaultWebSecurityManager = new DefaultWebSecurityManager();
defaultWebSecurityManager.setRealm(myRealm);
return defaultWebSecurityManager;
}
//配置一个自定义的Realm的bean，最终将使用这个bean返回的对象来完全我们的认证和授权
@Bean
public MyRealm myRealm() {
return new MyRealm();
}
//配置一个Shiro的过滤器bean，这个bean将配置shiro相关的一个规则的拦截
//例如什么样的请求可以访问什么样的请求不可以范文
@Bean
public ShiroFilterFactoryBean shiroFilterFactoryBean(SecurityManager securityManager) {
ShiroFilterFactoryBean shiroFilterFactoryBean= new ShiroFilterFactoryBean();
shiroFilterFactoryBean.setSecurityManager(securityManager);
shiroFilterFactoryBean.setLoginUrl("/login.html");//配置用户登录请求，如果需要登录就转入到这个登录页面
shiroFilterFactoryBean.setSuccessUrl("/success.html");//配置登录成功后跳转的地址
shiroFilterFactoryBean.setUnauthorizedUrl("/unamthorized.html");//配置无访问权限跳转的地址
Map<String, String> map=new LinkedHashMap<String, String>();
map.put("/login","anon");//anon配置登录求情不需要验证
map.put("/logout", "logout");//配置登出请求
map.put("/admin/**", "authc");//authc 需要登录验证
map.put("/user/**", "authc");//authc 需要登录验证
map.put("/**","authc");//配置剩余所有的请求都要进行验证（注意：一定要放到最后），可选的配置
shiroFilterFactoryBean.setFilterChainDefinitionMap(map);
return shiroFilterFactoryBean;
}
/**
*
* 开启shiro的注解支持
* */
@Bean
public DefaultAdvisorAutoProxyCreator advisorAutoProxyCreator() {
DefaultAdvisorAutoProxyCreator defaultAdvisorAutoProxyCreator=new DefaultAdvisorAutoProxyCreator();
defaultAdvisorAutoProxyCreator.setProxyTargetClass(true);
return defaultAdvisorAutoProxyCreator;
}
/**
* 开启aop的支持
* */
@Bean
public AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor(SecurityManager securityManager){
AuthorizationAttributeSourceAdvisor authorizationAttributeSourceAdvisor=new AuthorizationAttributeSourceAdvisor();
authorizationAttributeSourceAdvisor.setSecurityManager(securityManager);
return authorizationAttributeSourceAdvisor;
}
}
3.编写认证授权类
package org.huqi.config;
import java.util.HashSet;
import java.util.Set;
import org.apache.shiro.authc.AuthenticationException;
import org.apache.shiro.authc.AuthenticationInfo;
import org.apache.shiro.authc.AuthenticationToken;
import org.apache.shiro.authc.SimpleAuthenticationInfo;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authz.AuthorizationInfo;
import org.apache.shiro.authz.SimpleAuthorizationInfo;
import org.apache.shiro.realm.AuthenticatingRealm;
import org.apache.shiro.realm.AuthorizingRealm;
import org.apache.shiro.realm.Realm;
import org.apache.shiro.subject.PrincipalCollection;
import org.apache.shiro.web.filter.authz.AuthorizationFilter;
import org.apache.tomcat.util.http.parser.Authorization;
/**
* 标记当前是一个认证和授权的类
*
* */
public class MyRealm extends AuthorizingRealm{
/**
* 用户认证的方法
* @param authenticationToken 用户身份，这里存放着用户的账号和密码
* @param 用户登录成功后的身份证明
*
* @throws 如果shiro认证失败会抛出各种异常
* */
@Override
protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException {
UsernamePasswordToken myToken=(UsernamePasswordToken)token;
String userName=myToken.getUsername();
String passWord=new String(myToken.getPassword());
if(userName==null||passWord==null) {
return null;
}
//创建密码认证对象，由shiro自动认证密码
//参数1 数据库中的账号
//参数2 为密码
//参数3是当前real
return new SimpleAuthenticationInfo(userName, "123456", getName());
}
@Override
protected AuthorizationInfo doGetAuthorizationInfo(PrincipalCollection principals) {
Object obj = principals.getPrimaryPrincipal();
Set<String> set=new HashSet<String>();
if(obj.equals("admin")) {
set.add("admin");
set.add("user");
}
if(obj.equals("user")) {
set.add("user");
}
Set<String> prisesions=new HashSet<String>();
if(obj.equals("user")) {
prisesions.add("user:add");
prisesions.add("user:get");
}
SimpleAuthorizationInfo info=new SimpleAuthorizationInfo();
info.addRoles(set);
info.addStringPermissions(prisesions);
return info ;
}
}
4.编写controller
package org.huqi.controller;
import org.apache.shiro.SecurityUtils;
import org.apache.shiro.authc.UsernamePasswordToken;
import org.apache.shiro.authc.credential.Md5CredentialsMatcher;
import org.apache.shiro.authz.annotation.RequiresPermissions;
import org.apache.shiro.authz.annotation.RequiresRoles;
import org.apache.shiro.crypto.hash.Md5Hash;
import org.apache.shiro.crypto.hash.SimpleHash;
import org.apache.shiro.subject.Subject;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.ExceptionHandler;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
import org.springframework.web.bind.annotation.RestController;
@Controller
public class TestConfig {
@RequestMapping("/success")
public Object loginSuccess() {
return "/success.html";
}
@RequestMapping("/login")
public Object logout(String userName,String passWord) {
Subject subject=SecurityUtils.getSubject();
subject.logout();
if(!subject.isAuthenticated()) {
UsernamePasswordToken usernamePasswordToken=new UsernamePasswordToken(userName, passWord);
try {
//如果认证失败就会抛出异常
subject.login(usernamePasswordToken);
}catch(Exception e) {
e.printStackTrace();
return "/login.html";
}
}
return "/success.html";
}
@RequestMapping("/logout")
public Object login(String userName,String passWord) {
return "/login.html";
}
/**
* 指定当前方法或当前类需要什么角色
* */
@ResponseBody
@RequiresRoles(value = {"admin"})
@RequestMapping("admin/test")
public Object testAdmin() {
return "admin";
}
@ResponseBody
@RequiresRoles(value = "user")
@RequestMapping("user/test")
public Object testUser() {
return "/user";
}
/**
* 指定什么权限下才能访问
* */
@ResponseBody
@RequiresPermissions(value = {"user:add"})
@RequestMapping("user/add")
public Object add() {
return "user:add";
}
@ResponseBody
@RequiresPermissions(value = {"user:get"})
@RequestMapping("user/get")
public Object get() {
return "user:get";
}
@ResponseBody
@ExceptionHandler
public Object exception(Exception e) {
return "权限异常"+e;
}
}
